Can you help me create the regex for an Index time field extraction?

[MattibergB]

Hi,

We are trying to create an index time field extraction. I tried following the docs, but I am making a mistake somewhere.

It is working as a search time extraction, but we are running into performance issues/would like to use tsats without a datamodel.

The log line is:

Feb 21 20:28:22 server-name %PARSER-5-TESTLOG_LOGGEDCMD: User:unknown user  logged command:!exec: enable

props:

[sourcetype]
TRANSFORMS-test = test

transforms:

[test]
REGEX = %(?\S+):\s(?[\S\s]+)
WRITE_META = true

Is anyone able to point me into the right direction?

Thanks in advance!

[MuS · Accepted solution]

Hi MattibergB,

You don't necessarily need to have names for the capturing groups 😉

Try this in your transforms.conf

[test]
REGEX = %(\S+):\s([\S\s]+)
FORMAT = $1::$2
WRITE_META = true

Put it on the parsing instance and restart Splunk.

Hope this helps ...

cheers, MuS

PS: don't forget to add fields.conf on your SH like @somesoni2 mentioned

[MattibergB]

Thank you for pointing me in the right direction!

Matti

[somesoni2]

I hope you're following this documentation.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction#Define_ad...

So check these
1) ensure the regex is correct.
2) You need to have a name to the capturing group (name of the field). I don't see that in the config you posted in the question.
3) Add an entry in the fields.conf (see the documentation above).
4) Ensure that you're placing the config in correct Splunk server (heavy forwarder OR indexer whichever comes first on your data flow).